Coldcard Seed Flaw Exposes 1,196 Wallets in $70 Million Bitcoin Theft

What to Know

• More than 1,000 bitcoin, worth about $70 million, was drained from 1,196 Coldcard wallets on July 30.
• Galaxy Research mapped 1,082.65 BTC swept between 01:10 and 01:51 UTC across six blocks.
• The attack lasted 41 minutes and involved four addresses where the proceeds have not moved.
• Researchers say a firmware flaw in certain Coldcard hardware wallets weakened seed generation enough for attackers to recreate likely private keys offline.
• The attacker did not need to access the physical devices, connect to them, or compromise owners’ computers.
• The affected wallets included 1,183 using modern native segwit addresses, seven using an older standard and six using an older one still.
• Security teams found that older Mk2 and Mk3 generation could be determined, while Mk4, Q and Mk5 ranges were placed at roughly four billion possibilities.
• Coinkite has warned Mk3 owners and says newer devices are unaffected, while Block’s report places Mk2, Mk4, Q and Mk5 in scope as well.
• Investigators say the operator used a paid account at a well-known blockchain data provider, and logs have been passed to authorities.
• Security firms warn more wallets could be hit because owners cannot reliably determine whether their seeds were generated on vulnerable firmware.

A Cold Storage Breach Without Touching the Wallet

A major bitcoin theft tied to Coldcard hardware wallets has drawn intense attention across the digital asset security community because the attacker appears to have succeeded without touching the devices. More than 1,000 bitcoin, worth about $70 million, was drained from 1,196 wallets in a tightly compressed 41-minute window on July 30, with the sweep unfolding between 01:10 and 01:51 UTC.

Galaxy Research mapped the event at 1,082.65 BTC across six blocks, with three intervening blocks containing no related activity. That pattern suggests the transactions were broadcast in batches rather than in one continuous stream. The proceeds are currently sitting in four addresses and have not moved. Early visibility into the incident captured only one of those addresses, which is why the estimated loss has grown from the initial figure.

The size of the loss is not the only reason the episode stands out. Crypto thefts often involve an attacker reaching a hot wallet, tricking a smart contract, compromising an exchange, phishing credentials or stealing a key from an internet-connected device. This incident is more unsettling because the attacker appears to have rebuilt the keys from a weakened generation process. The cold wallets could have remained offline, disconnected and physically secure, yet the funds were still exposed.

Why Seed Generation Became the Critical Weak Point

Hardware wallets are designed around a simple security promise: the private key should never leave the device, and the secret from which that key is derived should be so unpredictable that guessing it is infeasible. When a wallet is created, it produces a seed. That seed becomes the foundation for the addresses and private keys the user later controls. If the seed is truly random and large enough, attackers cannot realistically enumerate the possibilities.

Researchers say the Coldcard issue disrupted that assumption. The firmware was meant to draw randomness from a dedicated hardware randomness generator. An internal build setting told it to skip that generator, while a check in a supporting library tested only whether the setting existed rather than whether it was switched on. As a result, key generation fell through to a basic software substitute seeded from the chip’s serial number and clock registers.

That distinction matters. A serial number is fixed factory metadata, and clock registers represent timing state that may be narrowed down or measured using another device. Instead of selecting from a space so vast that it is effectively unreachable, vulnerable devices could generate seeds from a much smaller and searchable range. In practice, the seed did not need to be stolen from the wallet. It could be reconstructed by generating candidates and checking whether those candidates produced addresses with balances on the public Bitcoin blockchain.

From Unimaginable Keyspace to Countable Possibilities

The central danger is that the universe of possible seeds was reduced from effectively impossible to enumerate into a space that computers could work through. Security teams found that generation of keys could be determined on the older Mk2 and Mk3 models. For the Mk4, Q and Mk5, they put the range at roughly four billion possibilities.

Four billion can sound enormous in ordinary terms, but it is not necessarily enormous for specialized computing workflows. An attacker can generate candidate seeds on their own hardware, derive the addresses that each candidate would produce, and then compare those addresses with public blockchain data. Bitcoin’s blockchain is public, meaning anyone can inspect addresses and transaction history. The victim’s hardware wallet does not need to be online, plugged in, unlocked or physically accessible.

This is what makes the incident so important for the broader crypto custody market. Cold storage has long been framed as protection through isolation. A private key held offline is supposed to remove an attacker’s direct route to the secret. But the Coldcard case highlights another requirement: the secret must also be impossible to recreate. If weak seed generation collapses the number of possible outcomes, offline custody alone does not solve the problem.

Address Patterns Point to Systematic Enumeration

The distribution of the drained wallets provides another clue about the nature of the attack. Of the 1,196 wallets hit, 1,183 used the modern native segwit address format, seven used an older standard and six used an older one still. That mix is consistent with a scanner checking candidate seeds against multiple derivation paths and address types rather than a targeted compromise of one person or one wallet setup.

Technical traders and security analysts often focus on visible price action after a major breach, but in this case the more important signal may be operational. A workflow that checks multiple address formats against likely seeds can be widened, paused, refined and restarted. If more vulnerable seeds remain funded, further waves are considered possible unless owners move assets away from exposed wallets.

Complicating matters, owners may not have a reliable way to determine whether they are exposed. There is no simple test a user can run against a wallet to prove whether the seed was produced inside the reproducible range. If a user generated a seed on vulnerable firmware, the safest working assumption is that the seed may be compromised, even if the device itself was never physically breached.

Dispute Over Which Coldcard Models Are in Scope

Coinkite, the maker of Coldcard, has warned Mk3 owners and says its newer devices are unaffected. Block’s report, however, places Mk2, Mk4, Q and Mk5 in scope as well. Until that gap is resolved, the practical challenge for holders is uncertainty. The issue is not simply whether a device is currently safe to store or use. The more difficult question is whether a seed generated earlier may already be inside a range that an attacker can enumerate.

For users, that distinction is critical. Updating firmware can address future behavior, but it does not automatically make an old weak seed strong. A seed generated with insufficient randomness remains a seed with insufficient randomness. In cases where exposure is plausible, moving funds to a new wallet generated under a trusted, uncompromised process is the defensive step market participants typically consider.

Security firms have warned that more wallets could be hit because attackers may continue searching. The funds already stolen have not moved from the four addresses identified in the mapping, but that does not mean the operation is complete. An enumeration-based attack can continue as long as there are candidate seeds left to test and balances left to find.

Blockchain Data Logs May Aid Investigators

The operator appears to have made an operational mistake. Block’s Clay Garrett said the attacker used a paid account at a well-known blockchain data provider to query source addresses during the sweeps. The provider’s internal logs reportedly matched the suspected workflow with extraordinary specificity, including the number, timing and sequence of requests.

The provider appears to have been supplying ordinary services to requests that did not reveal their purpose. Block has passed the information to authorities. While blockchain transactions are public, attribution often depends on linking on-chain behavior with off-chain infrastructure, account usage or other operational traces. In this case, query logs may help investigators understand how the attack was conducted and potentially who operated it.

The funds sitting unmoved in four addresses add another layer of visibility. Any attempt to transfer, split or launder the bitcoin will be observable on-chain. However, observation does not guarantee recovery. Digital asset theft investigations often depend on whether funds touch identifiable services, whether operators make mistakes and whether law enforcement can connect blockchain activity to real-world identities.

A Larger Warning for Hardware Wallet Security

The Coldcard incident lands at a time when the security assumptions behind cryptographic systems are under renewed scrutiny. Cold storage remains one of the strongest custody models available when implemented correctly, but this theft shows that physical isolation is only one part of the security equation. The randomness used to create a key is just as important as the method used to store it.

Market participants have long treated hardware wallets as a defense against online compromise. That remains broadly true when devices generate secrets properly and users avoid exposing recovery phrases. But this case underscores a deeper lesson: a key can be unreachable and still vulnerable if it was never random enough in the first place. An attacker does not need to extract a seed from a device if the seed can be recreated from a small enough set of possibilities.

For bitcoin holders, the episode is a reminder to treat seed generation as a one-time event with permanent consequences. If that event occurred under flawed conditions, later caution may not repair the underlying weakness. Cold wallets can protect against many threats, but they cannot protect a secret that was born predictable.

Frequently Asked Questions (FAQs)

How much bitcoin was stolen from Coldcard wallets?

More than 1,000 bitcoin was stolen, with Galaxy Research mapping the total at 1,082.65 BTC. The bitcoin was worth about $70 million at the time described, and it was drained from 1,196 wallets.

When did the Coldcard wallet theft happen?

The theft occurred on July 30 during a 41-minute window. The mapped sweep took place between 01:10 and 01:51 UTC across six blocks.

Did the attacker access the physical hardware wallets?

Researchers say the attacker did not need to access the devices. The suspected method involved recreating likely private keys offline by exploiting weak seed generation, then checking derived addresses against the public Bitcoin blockchain.

Why was this attack unusual?

Most crypto thefts involve reaching a key through phishing, malware, exchange compromise or smart contract exploitation. This attack was unusual because the attacker appears to have rebuilt likely keys from a weakened seed generation process without touching the wallets.

Which Coldcard models are mentioned in the investigation?

Security teams found that key generation could be determined on older Mk2 and Mk3 devices, while the range for Mk4, Q and Mk5 was placed at roughly four billion possibilities. Coinkite has warned Mk3 owners and says newer devices are unaffected, while Block’s report places Mk2, Mk4, Q and Mk5 in scope as well.

Can wallet owners tell if their seed is vulnerable?

Security firms warn that owners cannot reliably determine whether their seed was generated on vulnerable firmware. There is no simple test that proves whether a specific seed sits inside the reproducible range.

Where are the stolen funds now?

The proceeds are sitting in four addresses and have not moved. Early reporting captured only one of those addresses, which is why the estimated loss later increased.

Why do the address formats matter?

The drained wallets included 1,183 using modern native segwit addresses, seven using an older standard and six using an older one still. That spread supports the view that the attacker systematically checked candidate seeds across multiple address paths rather than targeting one specific wallet type.

Could more wallets be drained?

Security firms warn that further waves are possible if owners generated seeds on affected firmware and do not move their funds. Because an enumeration-based workflow can continue offline, the risk may persist for funded wallets with vulnerable seeds.

What is the broader lesson for bitcoin custody?

The incident shows that cold storage depends not only on keeping keys offline, but also on generating them with strong randomness. A private key can be unreachable from the internet and still be at risk if the seed behind it is computationally guessable.

Photo by Alesia Kozik on Pexels